Security is a tax of $500-$1500 per user per year, more than the devices, connectivity services, and software license costs combined, and all the while the attack surface inflates. Can measurement help?